'Pack' session id into binary string before encrypting.

Since it's basically base36, we can treat it as base64 and pack 3:4.
This way, with the random padding added, we end up taking one block
of ciphertext less and we have shorter and more unique tokens.